From: Andrii Nakryiko Date: Mon, 17 Mar 2025 20:45:12 +0000 (-0700) Subject: Merge branch 'support-freplace-prog-from-user-namespace' X-Git-Tag: v6.15-rc1~98^2~3 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b02f072a36560a89155a1ebcb2ca6bd881333a8b;p=thirdparty%2Flinux.git Merge branch 'support-freplace-prog-from-user-namespace' Mykyta Yatsenko says: ==================== Support freplace prog from user namespace From: Mykyta Yatsenko Freplace programs can't be loaded from user namespace, as bpf_program__set_attach_target() requires searching for target prog BTF, which is locked under CAP_SYS_ADMIN. This patch set enables this use case by: 1. Relaxing capable check in bpf's BPF_BTF_GET_FD_BY_ID, check for CAP_BPF instead of CAP_SYS_ADMIN, support BPF token in attr argument. 2. Pass BPF token around libbpf from bpf_program__set_attach_target() to bpf syscall where capable check is. 3. Validate positive/negative scenarios in selftests This patch set is enabled by the recent libbpf change[1], that introduced bpf_object__prepare() API. Calling bpf_object__prepare() for freplace program before bpf_program__set_attach_target() initializes BPF token, which is then passed to bpf syscall by libbpf. [1] https://lore.kernel.org/all/20250303135752.158343-1-mykyta.yatsenko5@gmail.com/ ==================== Link: https://patch.msgid.link/20250317174039.161275-1-mykyta.yatsenko5@gmail.com Signed-off-by: Andrii Nakryiko --- b02f072a36560a89155a1ebcb2ca6bd881333a8b